# PhishDestroy domain threat record: trezo-iostartup.gitbook.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/trezo-iostartup.gitbook.io/ Machine-readable companion: https://phishdestroy.io/domain/trezo-iostartup.gitbook.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-16 04:40:08 UTC - Last availability or vendor check: 2026-10-22 10:06:48 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 9/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trezor ## Stored infrastructure - Observed IP address: 172.64.147.209 - Registrar in stored WHOIS data: Cloudflare, Inc. - Last stored HTTP status: 307 - Registration date (registry RDAP, gitbook.io): 2014-03-30 06:09:09 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/trezo-iostartup.gitbook.io - Certificate Transparency search: https://crt.sh/?q=%25.trezo-iostartup.gitbook.io - Web Archive lookup: https://web.archive.org/web/*/https://trezo-iostartup.gitbook.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview trezo-iostartup.gitbook.io is an impersonation phishing page built on a GitBook subdomain. Its title reads "Trezor.io/start | The official wallet" to pass as the setup page Trezor sends new hardware wallet owners to. The subdomain misspells the brand as "trezo" to catch users who search for setup help instead of typing the address. PhishDestroy first flagged it on 2026-09-16, and as of 2026-10-19 it was still online and serving a redirect. How the scam works Fake Trezor start pages target people setting up or restoring a device, the moment they are most likely to follow on-screen instructions without question. Pages of this kind steer the visitor toward a fake wallet app or update, or straight to a form that asks for the 12- or 24-word recovery phrase. Anyone who types that phrase hands over full control of the wallet. The attacker can then move the funds from any device, and a stolen seed cannot be reversed. Evidence Nine of 89 VirusTotal engines flagged the page as of 2026-09-23. The vendors include Kaspersky, BitDefender, Sophos, Netcraft, PhishFort, Emsisoft, Lionic and alphaMountain.ai. Several of these specialize in phishing and brand protection, so their agreement is meaningful even though most engines stayed silent. Spamhaus lists the host as DBL_ABUSED_PHISH, its category for a legitimate domain being abused to host phishing. The PhishDestroy blocklist also carries it. Infrastructure The operator did not register a lookalike domain. They published on GitBook's documentation platform, which gives the page a trusted parent domain and a working setup with no registration trail. Traffic resolves to Cloudflare, Inc. in Canada. The certificate from Google Trust Services (WE1) comes from the platform, so the browser padlock says nothing about whether the content is genuine. What to do If you entered your recovery phrase on this page, treat the wallet as compromised. Reset a genuine Trezor with a new seed and move any remaining funds to it immediately, before the attacker does. Uninstall any software you downloaded from the page. Set up devices only through Trezor's official site, and remember that Trezor never asks you to type your seed into a website. Defenders should block the subdomain, report it to GitBook for removal, and warn users that documentation-platform subdomains are being used to impersonate wallet brands. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/trezo-iostartup.gitbook.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trezo-iostartup.gitbook.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 11:04:18 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3ff0cbdb-38af-48e9-beec-1685a8a8fdc6.png Captured: 2026-09-23 03:03:05 UTC Source report: https://radar.cloudflare.com/scan/3ff0cbdb-38af-48e9-beec-1685a8a8fdc6 SHA-256: 628222d4bde073b2cde697af9ef06e8ec377d7f7120a3cea3880a3f9056f09cf ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:00Z", "uuid": "3ff0cbdb-38af-48e9-beec-1685a8a8fdc6", "scanned_at": "2026-09-23T03:03:05Z", "final_url": "https://trezo-iostartup.gitbook.io/us", "status": 200, "redirected": "same-domain", "history": [ { "url": "https://trezo-iostartup.gitbook.io/", "status": 307 }, { "url": "https://trezo-iostartup.gitbook.io/us/", "status": 302 }, { "url": "https://trezo-iostartup.gitbook.io/us", "status": 200 } ], "dom_hash": "1f8bd5137758aa2b9b95f1da5b68b872294fe7a04dac6088d0a385824382cde3", "doc_hash": "8f2f7c89372363773a6c966603d63fe76d59e0b57b9573467d92f2ff9a487338", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "trezo-iostartup.gitbook.io", "type": "A", "value": "104.18.40.47" }, { "name": "trezo-iostartup.gitbook.io", "type": "A", "value": "172.64.147.209" }, { "name": "trezo-iostartup.gitbook.io", "type": "AAAA", "value": "2a06:98c1:310d::6812:282f" }, { "name": "trezo-iostartup.gitbook.io", "type": "AAAA", "value": "2606:4700:4401::ac40:93d1" } ], "dnssec_valid": false, "ip": "104.18.40.47", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Cloudflare, Inc", "created": "2014-03-30T06:09:09Z", "updated": "2026-08-12T02:09:29Z", "expires": "2031-03-30T06:09:09Z", "nameservers": [ "hugh.ns.cloudflare.com", "dahlia.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:30:36Z", "analysis_at": "2026-09-28T12:17:59Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 9, "suspicious": 0, "undetected": 33 }, "detections": { "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Netcraft": "malicious", "Kaspersky": "phishing", "PhishFort": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "registrar": "Cloudflare, Inc", "created": "2014-03-30T06:09:09Z", "expires": "2031-03-30T06:09:09Z", "updated": "2026-08-12T02:09:29Z", "first_seen": "2026-09-15T03:36:17Z", "dns": [ { "ttl": 300, "type": "CAA", "value": "pki.goog" }, { "ttl": 300, "type": "A", "value": "172.64.147.209" }, { "ttl": 300, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 300, "type": "A", "value": "104.18.40.47" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:310d::6812:282f" }, { "ttl": 300, "type": "CAA", "value": "digicert.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:4401::ac40:93d1" } ], "dns_at": "2026-09-28T12:18:13Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "gitbook.io", "*.gitbook.io" ], "issuer": "Google Trust Services / WE1", "serial": "7e2ef8ff41e512cc133800ba73ca362e", "sha256": "f3e0d20bcdcb0f6afa89f62c0f4ef0ea0ddd7a7445d5cc7ae8b2e212568ea348", "subject": "gitbook.io", "valid_to": "2026-12-13T23:02:54Z", "valid_from": "2026-09-14T22:03:00Z" }, "whois": { "registrar": "Cloudflare, Inc", "registrar_iana_id": "1910", "registrar_url": "http://cloudflare.com", "created": "2014-03-30T06:09:09Z", "updated": "2026-08-12T02:09:29Z", "expires": "2031-03-30T06:09:09Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "dahlia.ns.cloudflare.com", "hugh.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```